How agents and brokerages stop closing wire fraud

The short answer

Cyber security for real estate agents comes down to protecting one thing: the email conversation around a closing. Criminals break into or imitate an agent’s, title company’s or attorney’s email, wait for the closing date, then send a buyer new wiring instructions. The money goes to the criminal and is rarely recovered.

The controls that stop this are not exotic. Turn on multi-factor authentication (MFA) for email and every transaction platform, tell clients at the first meeting that wiring instructions will never change by email, verify any payment detail by calling a number you already have, and make the brokerage responsible for devices, accounts and training rather than leaving each agent to figure it out alone.

Why agents are such a common target

According to the FBI’s 2025 Internet Crime Report, Americans filed 12,368 real estate fraud complaints with reported losses of about $275 million, up from 9,359 complaints and about $173 million in 2024. Business email compromise, the attack behind most closing wire fraud, accounted for more than $3 billion in reported losses across all industries in 2025. NAR reported the real estate figures in April 2026 and urged brokers to have a risk-reduction plan and regular wire fraud training.

Real estate has every ingredient a criminal wants: large one-time wires, many parties who have never met, public listing data that tells an attacker who is buying what and when, and agents who work from phones, personal laptops and free email accounts. Many agents are independent contractors, so security often falls between the agent and the brokerage, and nobody owns it.

How a closing wire fraud attack unfolds

1. Access. A phishing email asks the agent to view a document or sign in to a fake portal. The password, and sometimes a one-time code, is captured.
2. Watching. The attacker reads the mailbox quietly for weeks. They learn the deal, the closing date, the title company and the tone people use.
3. Hiding. They create inbox rules that move replies from the title company or buyer into a hidden folder so the real agent never sees them.
4. Strike. A day or two before closing, the buyer gets a message, from the real account or a look-alike domain, saying the wiring instructions have changed.
5. Pressure. The message stresses urgency so the buyer wires before anyone checks. By the time the real closing happens, the money has moved on.

The same pattern hits sellers, whose proceeds are redirected, and agents themselves, whose commission payments can be rerouted through a fake request to the brokerage’s accounting team.

Habits every agent should adopt

These cost nothing and stop most attacks even when an account is compromised.

• Set the rule on day one. Tell every buyer and seller, in person and in writing, that wiring instructions will never change by email or text, and that they should call you on a number they already have before sending money.
• Put a warning in your email signature. NAR has long suggested a standard wire fraud notice in agents’ signatures.
• Verify by phone, never by reply. The CFPB advises buyers to confirm wiring details with trusted contacts using a phone number agreed on in advance, not one from the email.
• Do not send sensitive data by email. Use your transaction platform or encrypted email for bank details, IDs and contracts.
• Treat urgency as a warning sign. A last-minute change plus pressure to act now is the signature of this scam.
• Keep your phone locked and updated. Your phone holds your email, MLS access and client contacts. A lost unlocked phone is an open door.

Not sure how exposed your brokerage is? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Controls a brokerage should own

Individual habits fail when one person is busy or tired. A brokerage that provides its agents with these controls removes the guesswork.

1. Company email for everyone. Move agents off personal Gmail and Yahoo accounts onto Microsoft 365 or Google Workspace accounts the brokerage controls. You can then enforce MFA, review sign-ins and shut off access when an agent leaves.
2. MFA everywhere it is offered. Email, MLS, transaction management, e-signature, banking and the CRM. App-based or phishing-resistant MFA is stronger than text messages, and CISA recommends phishing-resistant methods where possible.
3. Email security. Filtering for phishing and look-alike domains, external-sender banners, and alerts when someone creates an auto-forwarding or hiding rule.
4. Domain protection. Publish SPF, DKIM and DMARC records so criminals cannot easily send mail that appears to come from your domain.
5. Managed devices. Endpoint protection, automatic updates and disk encryption on any laptop that touches client files.
6. Same-day offboarding. When an agent or assistant leaves, disable their accounts that day and change shared passwords.
7. A written wire verification procedure. Who calls whom, using which numbers, before any money moves, including commission disbursements.
8. Training twice a year. Short, real examples of fake closing emails work better than long slide decks.

What to do in the first hour after a suspected fraud

Speed matters more than anything else. If a client may have wired money to the wrong account:

1. Call the sending bank immediately and ask for a wire recall. The CFPB gives the same advice.
2. File a complaint at ic3.gov with the transaction details.
3. Notify the title or escrow company and the brokerage’s broker of record.
4. Change the email password, sign out all sessions, check for forwarding and inbox rules, and confirm MFA is still under your control.
5. Contact your cyber-insurance carrier if you have a policy. Many require prompt notice.
6. Speak with counsel about notification duties to clients. This article is general information, not legal advice.

Questions for your IT provider or broker

• Can I see a report of who in our office does not have MFA turned on?
• Would we get an alert if someone created a rule forwarding an agent’s email outside the company?
• Is DMARC set to enforce on our domain, or only monitor?
• How quickly can you disable an agent’s access when they leave?
• Are our transaction files backed up, and when was a restore last tested?
• Can you help us answer our cyber-insurance questionnaire accurately?

JLB USA’s cybersecurity services cover MFA, access reviews, same-day removal of leavers, endpoint protection, email security, monitored backups with tested restores, a written recovery plan and help with insurance questionnaires. If your brokerage also needs day-to-day support, see our managed IT services. For a practical look at locking down Microsoft accounts, read our guide to Microsoft 365 security settings.

Keep reading

• Remote work security best practices for small and midsize businesses
• Google Workspace security best practices for small businesses
• Multi-factor authentication for small business: a rollout plan
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Microsoft 365 security settings
• Cyber insurance requirements in 2026